sudo and su root broken

Question

I cant seem to get either sudo to work or my root to work. i thought it was related to me changing the default shells or forgetting the root password but i rest the root password and changed the default shells from the emergancy shell ass wel as rebuild the selinux tags.

then i applied chmod 4755 /usr/bin/sudo from recovery mode this also did not fix anything.

Below is an illustration of the problem.

~/scripts took 1m1s
❯ sudo reboot now
Failed to write reboot parameter file: Permission denied

~/scripts took 3s
❯ sudo ./houdini.sh
nice: cannot set niceness: Permission denied

~
❯ su root
Password:
This account is currently not available.

~/scripts took 8m35s
❯ sudo -u root ./houdini.sh

[root@fedora scripts]$ cd ..
bash: cd: ..: Permission denied
[root@fedora scripts]$ mount -o remount,rw /
mount: /: must be superuser to use mount.
       dmesg(1) may have more information after failed mount system call.


❯ grep ^root: /etc/passwd
grep: CGI: Is a directory
grep: Desktop: Is a directory
grep: dev: Is a directory
grep: Documents: Is a directory
grep: Downloads: Is a directory
grep: git: Is a directory
grep: houdini19.0: Is a directory
grep: houdini19.5: Is a directory
grep: Music: Is a directory
grep: omniverse:: Is a directory
grep: Omniverse: Is a directory
grep: output.txt: Permission denied
grep: Pictures: Is a directory
grep: Public: Is a directory
grep: scripts: Is a directory
grep: Templates: Is a directory
grep: tools: Is a directory
grep: Videos: Is a directory

❯ id root
uid=970(root) gid=0(root) groups=0(root)


❯ grep root: /etc/passwd
oot:x:0:0:root:/root:/bin/bash
operator:x:11:0:operator:/root:/sbin/nologin
root:x:970:0:Super User:/root:/usr/sbin/nologin

currently this worries me

❯ sudo killall -u root

~
❯ sudo usermod -u 0 -o root
usermod: user root is currently used by process 100784 

(the process shifts every time i rerun)

Answer 1

It looks like the username of the root account has been changed to oot.

This might be a result of a mistake in editing the /etc/passwd file without using vipw to safeguard it... but together with having UID 970 as a fake root account looks more like your system may have been hacked: this looks like it might be the work of an intruder that tries to ensure the legitimate owner won't be able to easily revoke intruder's access.

See this post in Information Security StackExchange: How to deal with a compromised server?